While ASP permission-fighting, discovered a couple of usefull utils from SysInternals.
Filemon –shows File System activity
RegMon — shows registry activity
This is win vs lin to me. In linux it’s all built-in, already there, you can ask kernel, monitor everything, w/o installing anything.